orbit-shell-8069[.]vercel[.]app

This domain, orbit-shell-8069.vercel.app, is actively engaged in phishing operations targeting users of the Vercel platform. Analysis indicates the domain mimics legitimate Vercel deployment pages, specifically displaying a 'Deployment Paused' page title to deceive victims into believing the service is temporarily unavailable. The intent is to trick users into entering credentials or other sensitive information under the guise of reactivating a paused deployment, a common tactic in credential harvesting campaigns. Infrastructure analysis reveals the domain was registered through Tucows Domains Inc. on February 21, 2026, an unusually future date suggesting potential domain spoofing or registry manipulation. It resolves to the IP address 64.29.17.3, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The domain appears on 2 security blocklists and is flagged by 1 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WR1), which, while legitimate, does not mitigate the malicious intent of the domain. Users who have visited orbit-shell-8069.vercel.app should immediately revoke any entered credentials, particularly those associated with Vercel or other development platforms. Monitor accounts for unauthorized access and enable multi-factor authentication where available. Network administrators should block the domain and its resolving IP (64.29.17.3) at the firewall or DNS level to prevent further exposure. If credentials were submitted, assume compromise and rotate passwords for all potentially affected accounts.